Run pull request code only inside a Modal Sandbox#8170
Conversation
Signed-off-by: Masahiro Tanaka <mtanaka@anyscale.com>
Signed-off-by: Masahiro Tanaka <mtanaka@anyscale.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0c4a7800fc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| def run_sandbox_command(sandbox: Any, modal_module: Any, command: RemoteCommand) -> str: | ||
| process = sandbox.exec( | ||
| *command.argv, | ||
| stderr=modal_module.stream_type.StreamType.STDOUT, |
There was a problem hiding this comment.
When an untrusted install or pytest command writes to stderr, StreamType.STDOUT sends that stream straight to the runner stdout instead of through the loop that prefixes, escapes, and enforces MAX_DISPLAY_BYTES_PER_COMMAND; only process.stdout is drained by this code. That lets PR-controlled stderr emit raw GitHub workflow commands or flood the job log despite the cap, so keep stderr piped and drain/cap it with the same sanitizer as stdout.
Useful? React with 👍 / 👎.
2 participants
GitHub recently changed
actions/checkoutto reject fork pull request checkouts by default in privilegedpull_request_targetworkflows. This protection was introduced inactions/checkoutv7 and backported to supported floating major versions, includingactions/checkout@v4. As a result, the current workflow's checkout of${{ github.event.pull_request.head.sha }}is now rejected for fork pull requests.Setting
allow-unsafe-pr-checkout: truewould restore the previous behavior, but it would deliberately bypass this protection. Apull_request_targetworkflow runs trusted default-branch code with access to the base repository's token and secrets. Because this workflow needsMODAL_TOKEN_IDandMODAL_TOKEN_SECRETto start GPU CI, the code that handles those credentials must remain trusted code frommaster; pull request code must not execute in the same GitHub runner context.Modal documents Sandboxes as secure containers for executing untrusted code, including checking out a repository and running its test suite. This change follows that model: GitHub runs only the trusted selector and Modal controller, while the pull request is treated as data during test selection. The controller passes only a validated public repository name, exact commit SHA, and validated test selection to a Modal Sandbox. The Sandbox receives no GitHub, Modal, or Hugging Face credentials, and performs the candidate checkout, dependency installation, DeepSpeed installation, and pytest execution itself.